← Back to driver explorer
Driver intelligenceVulnerableVerified
windrvr1251.sys
Jungo WinDriver versions 6.0.0 through 16.1.0 are affected by multiple kernel security issues fixed in version 16.2.0. The tracked 12.5.1 through 14.1.1 builds fall inside that affected interval. CVE-2024-26314 allows a low-privileged local attacker to escalate privileges and execute arbitrary code. The 14.1.1 driver exposes METHOD_NEITHER requests that reach port I/O, PCI configuration, and mapped-resource operations after the required WinDriver registration workflow.
Known samples 7
0 recorded TRUE · 0 recorded FALSE · 7 unknown for loading despite HVCI. Results apply to individual samples.
windrvr1260.sysSample 1 · HVCI unknown
- MD5
7c00fb2ab22211127cf8822ae5f4b524- SHA1
a5cc29a36a2db990f1c2a104b187abcc3589e3d0- SHA256
072f16148483afeeb0c37c745421df83f26d8359da95dc1219a700742cf010f7- Imphash
63ff5328c415b7dd9fb081af1973c137- Authentihash MD5
9a906bd47a073be9e33d73fbf98245a3- Authentihash SHA1
a9eadf8ba66413db9710150087b08b5cb6c4bfc9- Authentihash SHA256
254b14e05fd9e0edee406c528a867e848aabb0506ea603e0e51522c907a01c94- Machine
- AMD64
- Version
- 12.6.0
- Publisher
- Jungo Connectivity
windrvr1411.sysSample 2 · HVCI unknown
- MD5
ed91e277e4f55465d152f2588d204951- SHA1
59b759c4a9647210a625ea13397ec3a043817a92- SHA256
2421533941c9dab234239feb9f2a72ed13b21f3f9da9829dffe232282b1bc4b6- Imphash
4e7885c15e90eb195110f48193eb7de1- Authentihash MD5
8f84b910f21f1a66037ebb36d0314613- Authentihash SHA1
bed629b9a14167fed939c709c99211802ff232be- Authentihash SHA256
443a8982b1bdee0877e7f94a216914844be3c40b457a9e17148c2f81dafe0dd5- Machine
- AMD64
- Version
- 14.1.1
- Publisher
- Jungo Connectivity
windrvr1260.sysSample 3 · HVCI unknown
- MD5
ead582d5ca1d9fcb9c4a20b93df66b2f- SHA1
45260b8e29c1901fbd6e7c158c784318618f1261- SHA256
7203e3a3621f52785840e79da262d03b2ad179a406f448ad83bbbbd32ba64dd0- Imphash
63ff5328c415b7dd9fb081af1973c137- Authentihash MD5
9a906bd47a073be9e33d73fbf98245a3- Authentihash SHA1
a9eadf8ba66413db9710150087b08b5cb6c4bfc9- Authentihash SHA256
254b14e05fd9e0edee406c528a867e848aabb0506ea603e0e51522c907a01c94- Machine
- AMD64
- Version
- 12.6.0
- Publisher
- Jungo Connectivity
windrvr1280.sysSample 4 · HVCI unknown
- MD5
3d6927933e9b0413efcaa7eb7b5c0719- SHA1
c570e03d9e27a33df268d6c4a0e5f6e09ef9bc64- SHA256
b8d8f642ef62d2781e2dc4d1f797c66599961b43e469d30b6ce1dce718cc5808- Imphash
043f918df206295e42c363b5288eaaba- Authentihash MD5
b4dacc864899a1a57550f739305a88f1- Authentihash SHA1
5138910ce98dee8b70db7985afe38a28dd466b61- Authentihash SHA256
e4e613e586ccd41daf27a7e55edb3e6d74e25052862c27403a404b103cbb8e1a- Machine
- AMD64
- Version
- 12.8.0
- Publisher
- Jungo Connectivity
windrvr1251.sysSample 5 · HVCI unknown
- MD5
b16775b5512ee8f760984d4048d3fa71- SHA1
105da7bf907e754c00911d091825bd6487e208f9- SHA256
d217dbb7738ae0a9b8c054d553c94d9d3de9e08d5e98b007c041f4efe766d241- Imphash
bd304184eb21b2b188713aaabcf14c40- Authentihash MD5
a6ecb264daee700afbea7409f69b0e84- Authentihash SHA1
105c4ed821908622b3e87f53e63100c3f3ac0aa4- Authentihash SHA256
c7f668acffa12fc2cde7e9baef4da0ff526a1b569d0e453b85f53e9916ceb38e- Machine
- AMD64
- Version
- 12.5.1
- Publisher
- Jungo Connectivity
windrvr1411.sysSample 6 · HVCI unknown
- MD5
0fda09c2037d9620ed267b030e3d2f29- SHA1
018e39018b665e60de14302853b74ad3ee5309b8- SHA256
de8172a5989463dee93862985da6384b1e265c29ff5ff7b546f7ca38e0043377- Imphash
4e7885c15e90eb195110f48193eb7de1- Authentihash MD5
8f84b910f21f1a66037ebb36d0314613- Authentihash SHA1
bed629b9a14167fed939c709c99211802ff232be- Authentihash SHA256
443a8982b1bdee0877e7f94a216914844be3c40b457a9e17148c2f81dafe0dd5- Machine
- AMD64
- Version
- 14.1.1
- Publisher
- Jungo Connectivity
windrvr1281.sysSample 7 · HVCI unknown
- MD5
aac64c8f77dc0fda6765326672a90427- SHA1
0af592a352a2005e06ae0f389bdc50648c12a180- SHA256
fb007d649728eace633ce12eb4287cc3ecf47fbfe1f9a875a7e8e992fa36b972- Imphash
043f918df206295e42c363b5288eaaba- Authentihash MD5
0787146ccf9ea8ae04e33407aa1aff39- Authentihash SHA1
88d4cbc24cfa5f0aae4e704503989b2293b4f8ff- Authentihash SHA256
6742c0ff50c1d6357acb67feda2950f5224cdee37d036f18c292392e44b69443- Machine
- AMD64
- Version
- 12.8.1
- Publisher
- Jungo Connectivity
Recorded command
sc.exe create WinDriver type= kernel binPath= C:\\windows\\temp\\windrvr1411.sys && sc.exe start WinDriverElevate privileges · Privileges: User · OS: Windows
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/409
- https://github.com/fluffycats31/vulnerable-drivers
- https://windriver.jungo.com/version/version-16-2-0/
- https://nvd.nist.gov/vuln/detail/CVE-2023-47569
- https://nvd.nist.gov/vuln/detail/CVE-2023-47570
- https://nvd.nist.gov/vuln/detail/CVE-2023-47571
- https://nvd.nist.gov/vuln/detail/CVE-2023-47572
- https://nvd.nist.gov/vuln/detail/CVE-2024-26314
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04
Acknowledgement: fluffycats31 @fluffycats31